If you’ve already determined the signup request to be spam, and you want the spammer to think the site is broken, just return a 500?
The Frustration Loop
11–20 of 158 posts
Re: The Frustration Loop
#12Spam teams at social networks typically shadow-ban spammers. The goal of this is to make it as difficult as possible for the spammer to determine that they've been caught (which is why I think the frustration techniques, or simply account suspension aren't widely used). The field of spam-prevention is fascinating because it's essentially an arms race between companies deploying tactics to detect spam and sophisticate…
[dead]
Re: The Frustration Loop
#13Spam teams at social networks typically shadow-ban spammers. The goal of this is to make it as difficult as possible for the spammer to determine that they've been caught (which is why I think the frustration techniques, or simply account suspension aren't widely used). The field of spam-prevention is fascinating because it's essentially an arms race between companies deploying tactics to detect spam and sophisticate…
Depending on the context, account suspensions can be weaponized. By making someone you don't like /look/ like they are doing something dodgy, you can get them banned.
Re: The Frustration Loop
#14I'm missing the part on how op determines valid users for the frustration loop. > Enter Akismet... Blocking spam on signup worked somewhat, but was easily circumventable > some spammers found ways to parade as legitimate blogs... which I would have to manually sniff out and flag. > This lead me to an idea: The Frustration Loop... When spam is detected... Waste their time and make them give up. > "Now hold up there He…
Does Akismet detect spammers when they sign up?
afaik its main feature is an API to detect whether a given comment is spam: https://akismet.com/developers/comment-check/
Re: The Frustration Loop
#15I'm missing the part on how op determines valid users for the frustration loop. > Enter Akismet... Blocking spam on signup worked somewhat, but was easily circumventable > some spammers found ways to parade as legitimate blogs... which I would have to manually sniff out and flag. > This lead me to an idea: The Frustration Loop... When spam is detected... Waste their time and make them give up. > "Now hold up there He…
They pay for Akismet and run the users signup info through it. You can see the kind of data they send to them in the GIF on the post. If Akismet says yes, this is spam, then engage the frustration loop. I thought it was clever.
Re: The Frustration Loop
#16Spam teams at social networks typically shadow-ban spammers. The goal of this is to make it as difficult as possible for the spammer to determine that they've been caught (which is why I think the frustration techniques, or simply account suspension aren't widely used). The field of spam-prevention is fascinating because it's essentially an arms race between companies deploying tactics to detect spam and sophisticate…
Depending on the context, account suspensions can be weaponized. By making someone you don't like /look/ like they are doing something dodgy, you can get them banned.
Like fail2ban. Nothing quite like the anxiety of almost locking yourself out of your own system because you mistyped a password one too many times. It's a delicate balance (although, for something like SSH, I wouldn't even bother, unless the traffic is measurable enough to cause issues. But then you're getting (D)DoS'd, and you probably have bigger problems).
Re: The Frustration Loop
#17I'm missing the part on how op determines valid users for the frustration loop. > Enter Akismet... Blocking spam on signup worked somewhat, but was easily circumventable > some spammers found ways to parade as legitimate blogs... which I would have to manually sniff out and flag. > This lead me to an idea: The Frustration Loop... When spam is detected... Waste their time and make them give up. > "Now hold up there He…
Does Akismet detect spammers when they sign up? afaik its main feature is an API to detect whether a given comment is spam: https://akismet.com/developers/comment-check/
My guess? Akismet is metered, and he submits only the first few posts to lower costs. Once you have some reputation, you can post anything.
So spammers noticed being blocked on account 1, created account 2 with legitimate content, and then started spamming.
New process is detecting spammers on first post but instead of immediately sending them away (or throwing their content into the void), go to some length to pretend the website irreparably broken in subtle ways.
The point is to waste their time before they realise they've been flagged, and have them give up.
Re: The Frustration Loop
#18I've seen sites like discogs do this for tor exits. You quickly realize what they're doing. Same with shadowbans, I verify by accessing the post in a clean session.
Re: The Frustration Loop
#19Spam teams at social networks typically shadow-ban spammers. The goal of this is to make it as difficult as possible for the spammer to determine that they've been caught (which is why I think the frustration techniques, or simply account suspension aren't widely used). The field of spam-prevention is fascinating because it's essentially an arms race between companies deploying tactics to detect spam and sophisticate…
Modern spam tools I've encountered accept a second account list to be used for verification purposes for this reason. They can automatically purge shadowbanned accounts by spot checking comments for visibility.
Re: The Frustration Loop
#20"Frustration Loop"
It's a loop? I thought frustration is a constant state? It is for me at least.